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leditl Overview 

BLAZING SADDLES is the TDB 
portion of the second pilot of the Next 
Generation Events project under the Better 
Analysis Programme. The primary 
objective of BLAZING SADDLES is to 
increase the supportability and scale of 
presence events stored for a number of 
key internet profiling tools . This will be 
achieved by the deployment of a range of 
Applied Research QFDs and an instance 
of Black Hole to a TDB maintained 
experiment environment at Cheltenham 
and also at Bude. For more background to 
this work see the (J:)Internet Profiling SE 
Context provided by BA 

leditl Operational QFDs 



• BzS - useful info 

o Events Product Centre QFDs 
o Loading Status 

• Related products 

o Social Anthropoid 
o TDI Database 
o TDIs 

• Useful Links 

o Blazing Saddles Blog 
o SpvSpace Group 
o BLACK HOLE 
o NGE Input Buffer 
o NGE Gateway 
o Supporting Internet Operations 
o NGE GCForum 
o Training 

• Tech 

o Dev Server Info 

o (J: (Technical Documentation/SourcetZ:) 
o Technical Documentation 
o Infrastructure 
o QFD JEEOE deployments 
o Operational Deployment 
o Reference system activities 



QFD 



Type What it holds 



Questions it answers 



AUTOASSOC 



HRMap 



INFINITE MONKEYS 



KARMA POLICE 



MARBLED GECKO 



B ul jc unselected 

TDI-TDI System information 



correlations with 
confidence scores 
- information 

Events about which TDIs 
have been seen at 
the same times 
and from the 
same IP addresses 
as other TDIs. 

Host-referrer 
relationships - 
information about 

how people get to 

Events , F v & 

websites, 

including links 

followed and 

direct accesses. 

Bulk unselected 
v-bulletin 
identities - 
information about 

Events membership of 
webforums 
powered by 
v-bulletin 
software. 



Bulk unselected 
TDI-website 
correlations - 
information about 
which TDIs have 
Events been seen at 

approximately the 
same time, and 
from the same 
computer, as 
visits to websites. 



• What other TDIs belong to 
your target 

• What technologies your target 
is using (so long as those 
technologies generate TDIs) 



• How do people get to my 
website of interest and where 
do they go to next? 

• What websites have been 
visited from a given IP? 



• What v-bulletin accounts does 
my target have? 

• Who uses this v-bulletin 
forum? 

• Where are the members of this 
v-bulletin forum based? 



• Which websites your target 
visits, and when/where those 
visits occurred 

• Who visits suspicious 
websites, and when/where 
those visits occurred 

• Which other websites are 
visited by people who visit a 
suspicious website 

• Which IP address and web 
browser were being used by 
your target when they visited a 
website 



Content 



Information about 
the use of Google 
Earth and Google 
Maps. 



• When, where and from which 
IP address, particular areas of 
the earth have been looked at 

• What areas of the earth were 
looked at from a particular IP 
address or computer 



• (Combined with MUTANT 
BROTH) Who was looking at 
those areas of the earth 



MEMORY HOLE 



MUTANT BROTH 



SAMUEL PEPYS 



SOCIAL ANIMAL 



Information about 
the use of Google 
and similar 
services queries. 



Information about 

_ TDIs which were 

Events 

seen on the 
Internet. 



SAMUEL 
PEPYS is a near 
real time Internet 
diarisation tool. It 
enables powerful 
IP stream 

Events and analysis/profiling 

Content by fusing all 

available traffic 
types in one 
place. It contains 
both unselected 
events and 
content. 

Information about 
how users interact 

Events with other users, 

and with 
files/pictures 



• When, where and from which 
IP address, particular searches 
were made 

• What searches were made 
from a particular IP address or 
computer 

• (Combined with MUTANT 
BROTH) Who made those 
searches 

• Whether your target is being 
seen by the collection system 

• Where and when your target 
was active 

• What IP address your target 
was using 

• What other TDIs were seen on 
that IP address at a similar 
time 

• What kinds of computers does 
you target use 

• Who shares a computer with 
your target 

• Are there any CNE 
opportunities for your target? 



• SP can answer a wide range of 
analytic questions based on all 
available traffic types it 
contains. 



• Who your target interacts 
with. Interactions include 
chats, file-transfers and 
buddy-lists 



/video on the 
Internet. 



SOCIAL 

ANTHROPOID 



GOLDEN AXE 



Converged 
comms events 
database, 
allowing you to 
see who your 
targets have 
communicated 
with via phone, 
over the internet, 
or using 
converged 

„ channels (e.g. 

Events .. 

sending emails 

from a phone or 

making voice 

calls over the 

internet). Will 

subsume 

SOCIAL 

ANIMAL and has 
replaced 
HAUSTORIUM 
(now 

decommissioned). 

Primarily IMEI 
defeats, including 
a severity score 
and associated 
correlations for 

Events each IMEI. Other 
selectors such as 
IMSI, MSC_GT, 
VLR_GT will be 
supported in 
future. 



• What files/pictures/videos 
your target interacts with 



• What communications your 
target is engaged in 

• Who has your target been 
communicating with 

• What communications have 
occurred using a particular 
locator (IP address, cell tower, 
etc) 



• Is this handset cloned? 

• Does this selector uniquely 
identify my target? 
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